Results on GNSS Spoofing Mitigation Using Multiple Receivers


 Paul Wilkerson
 15 days ago
 Views:
Transcription
1 Received: 8 March 2021 Revised: 25 October 2021 Accepted: 12 November 2021 DOI: /navi.510 ORIGINAL ARTICLE Results on GNSS Spoofing Mitigation Using Multiple Receivers Niklas Stenberg 1 Erik Axell 1 Jouni Rantakokko 1 Gustaf Hendeby 2 1 Department of Robust Telecommunications, Swedish Defence Research Agency (FOI), Linköping, Sweden 2 Department of Electrical Engineering (ISY), Linköping University, Linköping, Sweden Correspondence Erik Axell, Swedish Defence Research Agency (FOI), Linköping, Sweden. Summary GNSS receivers are vulnerable to spoofing attacks in which false satellite signals deceive receivers to compute false position and/or time estimates. This work derives and evaluates algorithms that perform spoofing mitigation by utilizing double differences of pseudorange or carrier phase measurements from multiple receivers. The algorithms identify pseudorange and carrierphase measurements originating from spoofing signals, and omit these from the position and time computation. The algorithms are evaluated with simulated and livesky meaconing attacks. The simulated spoofing attacks show that mitigation using pseudoranges is possible in these tests when the receivers are separated by five meters or more. At 20 meters, the pseudorange algorithm correctly authenticates six out of seven pseudoranges within 30 seconds in the same simulator tests. Using carrier phase allows mitigation with shorter distances between receivers, but requires better time synchronization between the receivers. Evaluations with livesky meaconing attacks show the validity of the proposed mitigation algorithms. Keywords carrier phase, double difference, GNSS spoofing, pseudorange, spoofing mitigation 1 INTRODUCTION The use of Global Navigation Satellite System (GNSS) receivers has proliferated the last decade and they are used extensively in numerous commercial, as well as safety and securityrelated, applications. Spoofing attacks that can deceive GNSS receivers to compute incorrect position and/or time by transmitting false satellite signals constitute a serious threat to modern society (Psiaki & Humphreys, 2016). The possibility of spoofing GNSS receivers using lowcost hardware has been demonstrated by different research groups (see e.g., Humphreys et al. [2008]). GNSS spoofing has, for example, affected many vessels in or close to Russian territorial waters, such as in the Black Sea region (C4ADS, 2019). The emerging threat of GNSS spoofing underlines the importance of developing receivers that are resilient to spoofing attacks. The work presented herein is focused on spoofing mitigation, however, the mitigation approach is based on wellknown spoofing detection algorithms. Several NAVIGATION, 69(1) Institute of Navigation
2 spoofing detection algorithms that utilize data, such as computed receiver positions (as well as pseudorange or carrierphase measurements) from multiple receivers have been proposed in the literature, see e.g., Axell et al. (2015a, 2015b), Jahromi et al. (2016), Radin et al. (2015), Swaszek and Hartnett (2013, 2014), Wang et al. (2018), and Wen et al. (2019). In particular, double differences of pseudoranges or carrier phases are used for spoofing detection in Axell et al. (2015a), Jahromi et al. (2016), Wang et al. (2018), and Wen et al. (2019). Pseudorange double difference, as well as position solution differences, are used in Axell et al. (2015a) to make a joint decision of whether all receivers are spoofed or not. Spoofing detectors based on double differences of carrier phase and pseudorange as well as power ratio difference are proposed in Wang et al. (2018). Another algorithm for spoofing detection is derived in Wen et al. (2019), also based on pseudorange double differences. The algorithms of Jahromi et al. (2016), Wang et al. (2018), and Wen et al. (2019) use two receivers only. All these works make use of similar signal properties and a generalized likelihoodratio test (GLRT) to make decisions on individual double differences and deal with unknown parameters, and therefore share many common properties. Moreover, the algorithms of Wang et al. (2018) and Wen et al. (2019) have been used to discriminate individual double differences but do not extend to authenticating individual measurements. Different doubledifference tests containing the same pseudorange or phase measurement may result in contradicting decisions and must therefore be combined to make joint decisions on each measurement. Therefore, these algorithms cannot be used without further nontrivial extensions to mitigate attacks like these. By contrast, the work of Jahromi et al. (2016) makes use of the individual doubledifference GLRTs in combination with a graph approach to authenticate individual measurements. However, the graphbased approach assumes that there is only a single measurement for each pseudorandom noise (PRN) sequence, which is either spoofed or authentic. Hence, every spoofed PRN can only be detected and possibly excluded from the position, velocity, and time (PVT) computation, but the corresponding authentic measurement for the same PRN cannot be recovered. In Jahromi et al. (2014), carrierphase double differences were used in a receiver with two antenna elements to mitigate spoofing by first classifying spoofing signals, estimating them, and then subtracting them from the input signal. This requires a twoantenna system and is thus not suitable for a solution with multiple distributed receivers. When a receiver is subject to a spoofing attack, three scenarios may occur for each PRN sequence (corresponding to a specific satellite); each receiver acquires and tracks: a) the authentic signal only, b) the spoofing signal only, or c) both the authentic and spoofing signals (assuming the receiver has the ability to track multiple correlation peaks). The first case would not pose any problem, since the corresponding satellite signal was not spoofed. In the second case, the authentic signal would not be able to be recovered and included in a PVT solution since it would not be tracked, and the problem would therefore be cast back to a spoofing detection problem. The third case, and the main focus of this paper, poses the problem of deciding which of the received signals would be authentic and which would be spoofed, and to include the authentic signal only in the PVT computation. Detection of authentic and spoofing signals in Case a) and Case b) comes automatically with the spoofing mitigation algorithms proposed in this paper. That is, the proposed algorithms are able to mitigate a spoofing attack in the case of only a single measurement for some PRNs, which is dealt with in Jahromi et al. (2016), but also when two measurements are obtained for all PRNs.
3 This paper examines spoofing mitigation using pseudorange or carrierphase measurements from multiple receivers. Mitigation refers, in this context, to identifying authentic and spoofing signals, and including authenticated signals only in the resulting PVT solution. In contrast to previous work, it is assumed that the receiver is able to track multiple signals for the same PRN, allowing for reconstruction of the authentic signal while that same PRN sequence is being spoofed. In Ranganathan et al. (2016), spoofing was detected if more than one signal per PRN could be acquired, tracked, and if the separation between the acquired peaks was large enough. That is, the receiver could simultaneously track multiple signals per PRN. Furthermore, this work evaluated spoofing of the GPS L1 C/A signals; however, the algorithm could be readily extended to multiconstellation receivers (e.g., GPS and Galileo) where the double differences could be applied to signals from several constellations. Moreover, in scenarios where only a subset of the GNSS constellations are subjected to a spoofing attack, the pseudorange or carrierphase measurements for the unspoofed constellations could be authenticated and utilized in the subsequent PVTcalculations. Modern GNSS receivers already have hundreds of parallel channels to track multiple satellite signals from multiple constellations. Tracking both authentic and spoofing signals requires twice as many tracking channels as a standard receiver. It is therefore a matter of how to make best use of the already available channels or increasing the computational cost by doubling the number of tracking channels. The assumption of tracking both authentic and spoofing signals is necessary for the function of the considered mitigation process. In scenarios where the receiver is not able to track the authentic signal, typically when subjected to high power spoofing signals, the algorithms would still be able to identify the spoofing signals. The algorithms under consideration in this work were originally derived in our previous papers (Stenberg, 2019) for two receivers and extended in Stenberg et al. (2020) to more than two receivers. These publications developed novel spoofing mitigation algorithms using multiple ( 2) GNSS receivers based on previously known spoofing detection algorithms, and evaluated these algorithms in controlled hardware simulations utilizing a Spirent simulator. This paper summarizes and extends the work in Stenberg (2019) and Stenberg et al. (2020) by evaluating the spoofing mitigation approach with livesky meaconing tests and discussing practical problems and considerations, such as synchronization, for a realtime implementation of the algorithms. Thereby, this paper shows the vailidity of the spoofing mitigation algorithms for practical applications. The spoofing mitigation algorithms previously developed in Stenberg (2019) and Stenberg et al. (2020) are reiterated in Section 2. The implementation of the algorithms is described in Section 3, and the experimental setup and results are shown in Section 4. The livesky meaconing test setup and results are described in Section 5, while practical considerations for the algorithms are discussed in Section 6. Section 7 concludes this work. 2 SYSTEM MODEL AND PROPOSED ALGORITHMS A binary hypothesis test was first applied to pseudorange and carrierphase double differences to identify measurements that were generated by spoofing signals. The unknown parameters were dealt with using the GLRT. The binary decisions were then combined to make a final decision whether each (pseudorange or carrierphase) measurement was spoofed or authentic.
4 2.1 Assumptions The following assumptions are made in this work: The spoofing system utilizes a single transmit antenna. There are R 2 receivers that simultaneously receive authentic and spoofing signals from the same set of PRN sequences (i.e., satellites). The receivers are time synchronized or their measurements can be interpolated to common time epochs. No multipath errors are present. The receivers track both authentic and spoofing signals simultaneously for each satellite. These assumptions ensure that measurements are available from authentic and spoofing signals for each satellite at all times and that the double differences resulting from two spoofing signals are timeinvariant. This approach is applicable to any GNSS signal; however, in this work it is evaluated for the GPS L1 coarseacquisition (C/A) signal. The bare presence of multiple signals encoded with the same PRN sequence is enough to declare the occurrence of a spoofing attack. However, to mitigate spoofing (i.e., recover authentic signals while being under attack by a spoofer), a more complex algorithm must be introduced. The proposed algorithm is designed to select the correct signals among the set of both authentic and spoofing signals. That way mitigation is performed by computing the authentic navigation solution based on the identified authentic signals. 2.2 Models of Authentic and Spoofed GNSS Measurements The geometric distance between receiver i and satellite k at time n is denoted by ri k [ n]. The range to satellite k, induced by the spoofing signal at the transmitting antenna of the spoofing system, is denoted r k [ n]. The distance between receiver i and the spoofing transmission antenna is denoted by d i [n]. Moreover, clock errors in receiver i and satellite k are represented by t i [n] and T k [n], respectively. Depending on the type of spoofing attack, different timing errors may occur. For instance, a meaconing system introduces a processing delay while a selfconsistent spoofer typically introduces a timing mismatch. The resulting timing error is denoted T s [n] (where also potential atmospheric effects are included). Ionospheric and tropospheric errors (in meters) are denoted Ii k [ n] and ζ k i [ n], respectively, between receiver i and satellite k. The carrier wavelength is denoted by λ. The pseudorange measurement ρ k i [ n] in receiver i for satellite signal k is modeled as (adapted from Wang et al. [2018]): [ ] [ ] [ ] ( [ ] [ ]) [ ] (1) ρ k k i n = r n + di n + c ti n Ts n + i k n when it is generated by a spoofing signal, and: ρ [ n] = r [ n] + c( t [ n] Tk[ n]) + I [ n] + ζ [ n] + [ n] i k i k i i k i k i k when it is generated by an authentic signal. The terms k i [ n] and k i [ n] are measurement noise that are assumed to be zeromean Gaussian noise similarly to Wang et al. (2018). The noise terms are assumed to have approximately the same
5 variance, thus approximately having the same distribution, and k i [ n] is hereafter used to denote both terms. This is based on the assumption that both the correlation between different PRN sequences and the autocorrelation of the PRN sequences for nonzero delays are negligible. Let N k i and Ni k denote integers corresponding to the carrierphase cycle ambiguities between receiver i and satellite k, for authentic and spoofed measurements respectively. The model of the carrierphase measurement φ k i [ n] at time n for receiver i and satellite k is expressed as: φ [ n] = r [ n] + d[ n] + c( t [ n] T [ n]) + λn + ε [ n] (2) i k k i i s i k i k when the carrierphase measurement is generated by a spoofing signal (Jahromi et al., 2016), and: φ [ n ] = r [ n ] I [ n ] + ζ [ n ] + ct ( [ n ] T k[ n ]) + λ N + ε [ n ] i k i k i k i k i when it is generated by an authentic signal. The measurement errors, ε k i [ n] and ε k i [ n], are assumed to be zeromean Gaussian noise. The variable ε k i [ n] is henceforth used to denote both noise terms, motivated by the PRN correlation properties in analogy with the pseudorange measurements. i k i k 2.3 Identifying Spoofing Signals Based on Double Differences Double differences of pseudorange or carrierphase differences are used to identify measurements that have been generated from spoofing signals. The pseudorange single difference between two receivers i and j for satellite k at time n is defined as: ρ [ n] ρ [ n] ρ [ n] ij k i k j k and the double difference for satellite pair k and l is: ρ [ n] ρ [ n] ρ l [ n] ij kl ij k ij This notation is adopted from Jahromi et al. (2016) and Wang et al. (2018). The carrierphase single and double differences are computed analogously. The individual pseudorange or carrierphase measurements in the double difference can originate from either authentic or spoofing signals. Considering two receivers, i and j, and a satellite pair, k and l, the null hypothesis, 0, is the case where all (pseudorange or carrierphase) measurements in the double difference are computed from spoofing signals. The alternative hypothesis, 1, is the case in which at least one measurement in the double difference has been computed from an authentic signal Model of Pseudorange Double Differences Using the measurement model (1) of the pseudoranges computed from spoofing signals, the double difference under 0 is: ρ kl ij [ n] H = ε [ n] 0 ij kl
6 FIGURE 1 Pseudorange double differences in a spoofing scenario for a single satellite pair PRN 5 and 29 and two receivers separated by 100 meters The double difference ρ kl ij [ n] under 1 is generally not zeromean and does not have a single expression since it encompasses multiple cases. A simple model of it is that it is an affine function in time (for a sufficiently short time duration). This model is motivated by Figure 1 that shows examples of pseudorange double differences. The figure shows pseudorange double differences during a spoofing scenario where both authentic and spoofing signals are tracked. The spoofing system is located 500 m and 600 m, respectively, from the two receivers. The spoofing system also has an additional delay corresponding to 400 m. Double differences of all combinations of authentic and spoofing signals are shown. The double difference under 0 is close to zero and the differences under 1 are offset from zero and some of them exhibit slopes. The pseudorange double differences are therefore modeled as: wρ [ n], ρij kl [ n] = Aρ + Bρn+ wρ [ n] under 0 under 1 (3) where n = 1, 2,..., N and N defines the length of the observation window; A ρ and B ρ are unknown offset and slope coefficients, respectively; and wρ [ n ] ij kl[ n ]. That is, a simple firstorder polynomial is used to model the double difference under 1, which is similar to Wang et al. (2018), who used secondorder polynomials for the pseudorange double difference tests. A firstorder polynomial is deemed to be a good approximation for the short observation times (in the order of minutes) of practical interest, which is also supported by Figure 1. A ρ, B ρ, and w ρ depend on the receiver pair i and j, and the satellite pair k and l, but this dependence is not explicitly written out in order to simplify the expressions. The noise w ρ [n] is Gaussian with zeromean, which follows from the measurement models, and is further assumed to be white.
7 FIGURE 2 Carrierphase double differences in a spoofing scenario for a single satellite pair PRN 5 and 29 and two receivers separated by 100 meters; each double difference has had its initial value removed to facilitate comparison Model of CarrierPhase Double Differences The carrierphase double difference under 0 is obtained by using the model (2) of carrier phases computed from spoofing signals, and it can be written as: φij kl [ n] = λ Nij kl + εij kl 0 [ n] in which it is assumed that λ N ij kl is constant during the observation window, as in Jahromi et al. (2016). Examples of carrierphase double differences are shown in Figure 2, which shows all combinations of double differences for a single spoofing antenna scenario where the receiver tracks both authentic and spoofing signals for all GPS signals. The double difference under 0 is modeled as a timeinvariant offset plus noise, similarly to Jahromi et al. (2016) and further motivated by Figure 2, under 1, so that: A0 φ + wφ[ n], φij kl [ n] = A1 φ + B1 φn+ wφ [ n] under 0 under 1 (4) where n = 1, 2,..., N. A0 φ and A1 φ are offsets and B1 φ is a slope coefficient. The noise wφ [ n] εij kl [ n] is a zeromean Gaussian distribution and assumed to be white. A0 φ, A1 φ, B1 φ, and w φ depend on the receiver pair ij and the satellite pair kl, but this dependence is not explicitly written out in order to simplify the expressions. To conclude, the computed double differences, for either pseudorange or carrierphase measurements, for a certain satellite pair lk and receiver pair ij can be written as: () kl [ n] = Aij kl + Bij kl n+ wij kl [ n ] (5) ij
8 under both hypotheses. That is, the double differences are modeled as straight lines with slopes B ij kl and offsets A ij kl, for different values of A ij kl and B ij kl. 2.4 Hypothesis Testing of Double Differences Without loss of generality, let Receiver 1 be used as a reference, and consider the double differences between all other receivers 2,..., R for satellites k and l during the complete observation interval n = 1,..., N. These double differences are collected in the matrix: X kl, ρkl[] kl 21 1 ρ31[] 1 ρr kl 1[] 1 ρkl[] ρkl [] 2 ρr kl 1[] 2 ρkl N ρkl 21[ ] 31[ N] ρr kl 1[ N] The superscripts k and l are omitted in the following for simplicity of notation, so that X = X k,l for a specific (implicit) satellite pair k and l. Also note that the derivation is made for pseudorange measurements, but the model for carrierphase measurements is equivalent. The double differences can then be written as: with the observation matrix: the parameter matrix: and the noise matrix: X = HΘ + W (6) H N Θ A kl A kl A Bkl Bkl B T R kl R kl 1 kl kl 21[] 1 31[] 1 R kl 1[] 1 kl kl 21[] 2 31[] 2 kl R1[] 2 W kl kl 21[ N] 31[ N] R kl 1[ N] The measurement model given by Equation (6) is next vectorized as: x vec( XT) = vec( ΘTHT) + vec( WT) vec = ( H I ) vec( ΘT) + vec( W T) = H θ R 1 + w vec vec vec (7) where H H I T vec ( R 1 ), θvec vec( Θ ) and wvec vec( W T ). The symbol denotes the Kronecker product and vec denotes vectorization of a matrix by stacking the columns of the matrix in order to form a column vector.
9 2.4.1 PreWhitening of Linear Batch Model To be able to apply already derived GLRTs that assume white noise, the linear model is prewhitened. Let Ω denote the covariance matrix of the noise vector w vec, then: Ω= cov( w ) = I P vec assuming that the double differences from different time instances are independent and that the covariance of the noise does not change over the time window that is tested. The matrix P is given by: P = cov N [ n] kl[ n] [ n] kl[ n] [ n] 1 kl [ n] kl 2 1 kl 3 1 where [ n] = [ n] [ n]. The covariance matrix P can be written: i kl i k i l P R kl = σ 2 P where: P assuming that var( kl i [ n]) = σ 2 for i = 1, 2,..., R and cov( i kl [ n], kl j [ n]) = 0 for i j and i, j = 1, 2,..., R. That is, the noise terms are assumed to be uncorrelated between receivers and as having the same variance in all receivers. The matrix Ω can then be written as: Ω= I ( σ2p) = σ2( I P) = σ 2Ω N where Ω ( IN P). The matrix P is positive definite and thus has a square root P 12 /. It is then also possible to write the square root of Ω as: Ω 12 / N 12 / N 12 / N = ( I P) = I P It should be noted that any additional information that might be available (e.g., one receiver having larger noise power than the other) can easily be included in the model. It is possible to prewhiten Equation (7) using the square root Ω 1/2, yielding: x = Hθ + w (8) where x Ω1/2 x 1/2 vec, H Ω Hvec, and w Ω1/2w vec with covariance cov(w) = σ 2 I (Kay, 1998). The final hypothesis test is: x = Hθ0 + w x = Hθ1 + w under 0 under 1 (9)
10 where θ 0 = 0 and: θ 1 = Akl 21 Akl 31 A 1 B 21 B 31 B 1 R kl kl kl R kl T Parameter Value Formulation of Hypotheses and Generalized Likelihood Ratio Tests Based on the prewhitened linear batch formulation shown in Equation (8), the hypotheses from Equation (9) can be transformed to hypotheses on the parameter values instead: Cθ = b Cθ b under 0 under 1 (10) where the pseudorange case follows directly as C = I 2(R 1) and b = 0 2(R 1) 1. In the carrierphase case C = [0 (R 1) (R 1) I (R 1) ] and b = 0 (R 1) 1 to ignore the effects of the unknown constants present in both hypotheses. Given the formulation (10) a GLRT can be used to reject H 0 (see Kay [1998] for details). The GLRT was used also in Wang et al. (2018) and Jahromi et al. (2016) for doubledifference tests of the pseudorange and carrierphase measurements, respectively. Assuming that the noise variance σ 2 is known, the GLRT becomes: Cˆ θ b C H H C Cˆ θ b ( ) T[ ( T ) 1 T] 1( ) σ 2 1 > < γ 0 (11) where ˆ θ = ( H T H ) 1 HTx is the maximum likelihood estimate (MLE) of θ under H 1 (Kay, 1998). The probability of false alarm is in this case given by PFA = Qχ 2 ( γ ) r where Q is the righttail probability for the χ 2 distribution with r degrees of freedom (r = 2 in the pseudorange case and r =1 in the carrierphase case). The proba χr 2 bility of false alarm is the probability of incorrectly rejecting H 0. The threshold in Equation (11) giving the desired probability of false alarm is (Kay, 1998): γ = Q χ 21 ( PFA ) (12) r If the variance σ 2 is instead considered to be unknown, the GLRT becomes: N p Cˆ θ b C H H C Cˆ θ b r x I H H H H x ( ) T[ ( T ) 1 T] 1( ) T( ( T ) 1 T) 1 > < γ 0 (13) where ˆ θ = ( H T H ) 1 HTx is the MLE of θ under H 1 (Kay, 1998). The probability of false alarm is given by PFA = Q FrN ( γ ) where Q, p FrN is the righttail probability, p for the F distribution with r numerator and N p denominator degrees of freedom. Inverting the expression for the probability of false alarm yields a formula for computing the threshold as (Kay, 1998): γ = Q 1, ( PFA ) (14) F rn p
11 2.5 Spoofing Mitigation Based on DoubleDifference Hypothesis Tests The overall spoofing mitigation process, given that there are pseudorange or carrierphase measurements from both authentic and spoofing signals available, is: 1. For each satellite k, compute all possible pseudorange single differences ρ ij k or carrierphase single differences φ ij k for the receiver pair i and j. Each satellite gives rise to four single differences for a receiver pair if each receiver tracks two signals per satellite. 2. For each combination of two satellites k and l, compute all possible double differences ρ ij kl or φ ij kl, respectively. Apply the appropriate GLRT to each double difference. Count the number of times individual pseudorange or carrierphase measurements belong to double differences where H 0 cannot be rejected. 3. Remove measurements that are counted (indicated to be spoofed) at least K 1 times, where K is a predetermined threshold. The criterion is based on the assumption that the spoofing system transmits K or more spoofing satellite signals from a single transmission antenna. In this work, K is set to 4. See below for a further explanation of the parameter K. 4. If more than one (pseudorange or carrierphase) measurement for a satellite remains at this stage, then the algorithm is unable to identify the authentic signal and the measurements from that satellite should be omitted. 5. All remaining signals are considered authentic (not classified as spoofed), and can be used in the subsequent PVT computations. A key assumption for the mitigation algorithm and the selection of the threshold K is that the spoofer utilizes a single transmit antenna. That assumption is exploited to identify spoofing signals based on the combination of individual doubledifference tests. To mitigate the problem with false identification of spoofing signals, measurements have to be indicated as spoofed K 1 times out of all the individual satellite pairs that are tested. If a measurement has been indicated as spoofed K 1 times, the test procedure implies that it is originating from the same source as K 1 other signals that also have been indicated as spoofing signals. That is, there is a group of K signals originating from the same source. In the sequel of this work, K = 4 is chosen based on the assumption that at least four signals are spoofed, which is the minimum number required to compute position and time. A smaller K results in higher risk of signals mistakenly being identified as spoofed, and a larger K results in lower probability of identification of spoofing signals. The principle of requiring measurements to be identified multiple times is similar to the graph approach in Jahromi et al. (2016), where K is the number of vertices (PRNs) connected together due to being identified as spoofing. Different thresholds of the number of connected vertices are investigated in Jahromi et al. (2016), where four is one them. 3 IMPLEMENTATION This section briefly describes how the algorithms were implemented and evaluated. For more details on the implementation, see Stenberg (2019). An overview
12 FIGURE 3 Overview of the prototype implementation; this work has made modifications or implementations in the gray blocks whereas the other blocks indicate software or hardware that were used without modifications. of the prototype implementation is shown in Figure 3. This implementation was used for the simulation tests in Section 4 as well as for the livesky tests in Section 5. The open source softwaredefined GNSS receiver GNSSSDR 1 was used to compute the pseudorange and carrierphase measurements. GNSSSDR (version ) was modified to acquire and track both authentic and spoofing signals simultaneously. In Ranganathan et al. (2016), which was mentioned in the introduction, GNSSSDR was modified and used to acquire and track multiple signals per satellite to perform spoofing detection. The GNSSSDR project is described in FernándezPrades et al. (2011). A USRP 2 (universal software radio peripheral) was used as a radiofrequency frontend to record complex baseband samples at 4 MHz that were input to GNSSSDR. The proposed mitigation algorithm described in Section 2.5 requires that both the authentic and spoofing signals are tracked in order for the measurements from the spoofing signals to be identified and discarded, ideally leaving only authentic measurements for PVT computation. Computation of the decision statistic can contain measurements from only authentic signals, only spoofing signals, or a combination. The actual mitigation, consisting of identifying and discarding spoofing measurements, was performed in MATLAB where pseudorange and carrierphase measurements from GNSSSDR were taken from GNSSSDR at a sampling rate of 1 Hz. Measurements from separate receiver runs were synchronized by directly using the time stamps provided by GNSSSDR for its observed measurements. These time stamps are based on a common reception time across the tracking channels that is set by GNSSSDR based on a reference satellite 3. These time stamps were possible to use for evaluation and validation in this test implementation and with the controlled spoofing scenarios that have been evaluated. However, a more robust and accurate time synchronization mechanism is necessary in practice (see Section 6.4 for a discussion about this). Measurements identified as coming from spoofing 1 See
13 signals were removed in the mitigation process and the remaining measurements were forwarded to the RealTime Kinematic Library 4 (RTKLIB) for PVT computations. Computations of correct position estimates were verified to work in RTKLIB when the authentic measurements were successfully extracted. 4 SIMULATION TESTS This section explains the configurations of the simulated spoofing scenarios as well as the mitigation performance of the proposed algorithms. Seven satellites were tracked in these simulations. Note also that for each of the satellites, two signals were tracked, where seven were authentic signals and seven were spoofing signals. The four different variations of the proposed GLRT, for pseudorange or carrierphase measurements and for unknown or known noise variance are evaluated, and denoted Detectors 1a, 1b, 2a, and 2b according to Table 1. TABLE 1 Different detectors for identification of spoofed measurements Detector Measurement Equation Noise variance 1a Pseudorange (11) known 1b Pseudorange (13) unknown 2a Carrier phase (11) known 2b Carrier Phase (13) unknown 4.1 Simulated Scenarios Simulated meaconing scenarios with different receiver positions were generated with a Spirent GSS9000 GNSS Signal Generator. The Spirent GSS9000 was configured to simultaneously generate both authentic and spoofing signals using its two RFoutputs and functionality of simulating two vehicles. Signals for those satellites seen in the sky by the receiver at the current time and position were simulated. Scenarios with a stationary receiver and spoofer positions were generated using the parameters given by Table 2. To simulate a processing delay and a delay TABLE 2 Simulation scenario parameters Parameter Start time Simulation time Base position a Simulated signal Satellite orbits Value 01Jul :00:00 UTC 20 min 59, 17, 100 m (lat., lon., height) GPS C/A code on the L1 frequency Nominal a The position that the receiver positions are defined in relation to. 4
14 FIGURE 4 Simulated positions of the receivers and the meaconer between the reception and transmission antennas of the meaconing system, a propagation delay corresponding to 400 meters was added to the spoofing signals in addition to their propagation delay. Noise was not amplified by the simulated spoofing system as it would be in a real meaconing attack, thus the spoofing attacks can also be seen as selfconsistent spoofing. In the simulations, no path loss difference for the propagation of the spoofing signals to the different receiver positions were simulated. The difference in distance is small since the receivers are relatively close, so the difference in path loss in an actual setup is insignificant. The simulated receiver positions (denoted Rx i ) and the position of the meaconer are shown in Figure 4. Each receiver position was simulated once. Different simulations were performed for each receiver and its individual position by essentially running the same scenario but moving the receiver position and adjusting the fixed delay of the spoofing signals accordingly. The simulated receiver positions were combined into different scenarios according to Table 3 to examine the performance in different geometries and with different distances. Both the authentic and the spoofing signals were present from the beginning of the scenarios. The signal power was generated to correspond to the nominal signal power at the surface of the Earth, but with variations depending on satellite elevation. The authentic and spoofing signals were simulated with the same power levels in all scenarios, except in Section 4.2.2, where the impact of differing power levels is evaluated explicitly. Furthermore, realistic livesky tests are described in Section 5.
15 TABLE 3 Receivers used in each scenario and the distance between the receivers in each scenario; the direction that the receivers are located on is specified as either SENW (southeast to northwest) or SWNE (southwest to northeast). Scenario Receivers Receiver distance (m) Direction 1 Rx 1, Rx SENW 2 Rx 3, Rx SWNE 3 Rx 1, Rx 5 1 SENW 4 Rx 1, Rx 6 5 SENW 5 Rx 1, Rx 7 10 SENW 6 Rx 1, Rx 8 20 SENW 7 Rx 1, Rx 9 35 SENW 8 Rx 1, Rx SENW 4.2 Spoofing Mitigation Using Pseudoranges Initial evaluations were performed to compare Detectors 1a and 1b, assuming known and unknown noise power and using the theoretical thresholds given by Equations (12) and (14), respectively. An average variance from the different scenarios was computed in advance for the double differences under H 0 and used in Detector 1a. The thresholds were set using a probability of false alarm of 1%. Compared to Detector 1b, Detector 1a did not provide consistently better results for all scenarios. Note that the variance of the double differences can vary for different scenarios. Hence, using a test statistic that assumes the variance to be known is usually not well suited in practice. Thus, Detector 1b that assumes the variance to be unknown will be used for the evaluations of the pseudorange algorithm from here on Different Observation Window and Receiver Distances The average number of correctly authenticated signals (i.e., authentic signals not removed in the mitigation process) using Detector 1b was evaluated for different lengths of observation windows in the different scenarios (see Figure 5). The average number of correctly authenticated signals was used as a performance indicator. It should intuitively improve with increasing observation length, which it does in most cases. The average was calculated over the 20min simulation duration by dividing it into intervals with the same length as the observation windows under evaluation. That is, less averaging was performed for the evaluations of the longer observation intervals. Since the total number of tracked authentic signals were seven (seven spoofing signals were also tracked), and if, for example, only four authentic signals were correctly authenticated, then three authentic signals would be missed. Most signals were correctly authenticated within 30 seconds for receivers separated by at least 10 meters. Spoofing signals remaining after the mitigation process were signals that had been incorrectly authenticated. The number of incorrectly authenticated signals was zero for the results in Figure 5 using Detector 1b in all cases, except for receiver distances of 5 meters, using an observation window of 10 seconds, where sporadic erroneous authentications occurred.
16 FIGURE 5 The performance of Detector 1b using pseudoranges and Detector 2b using carrier phases for Scenarios (Sc.) 1 8; average number of correctly authenticated signals is shown as a function of the length of the observation window. In total seven authentic and seven spoofing signals were tracked. The spoofing mitigation approach based on pseudoranges performed well for receiver distances larger than or equal to 5 meters. The slight decrease in performance for the 35meter distance compared to 20 meters could have been caused by the receiver to satellite geometry in that particular case. More pseudorange double differences under H 1 were close to zero in the former case. The performance in Scenario 1 was better than in Scenario 2, which shows that there is a dependence on the geometry of receivers and spoofing system Spoofing Signals with Different Power Levels Different power levels of the spoofing signals, 3 db, +3 db, +10 db, and +20 db relative to the authentic signals, were simulated in separate runs and evaluated for receiver positions Rx 1 and Rx 10 (separated by 50 meters; Stenberg et al. [2020]). The power level of the spoofing signals was fixed during the simulations. The unmodified version of GNSSSDR without spoofing mitigation was first evaluated with these simulations. The correct position was computed only in the 3 db case. It did not compute any position at all in most cases when the spoofing signals and authentic signals had equal power levels, likely because it acquired a mix of authentic and spoofing signals that produced inconsistent sets of measurements. The spoofed position was computed in the +3 db, +10 db, and +20 db cases.
17 The modified GNSSSDR was then used to evaluate Detector 1b at different spoofing power levels, using a probability of false alarm set to 0.1%. Observation windows between 30 and 360 seconds were evaluated. The spoofing mitigation algorithm worked well, indicated by the average number of correctly authenticated signals that was close to seven. The performance degraded to in average six correctly authenticated signals only in the +10 db and +20 db cases and for the shortest observation interval. The system including the modified GNSSSDR, as shown in Figure 3, could still calculate the correct position. The number of incorrectly authenticated signals was zero in all cases. 4.3 Spoofing Mitigation using Carrier Phases Evaluations of the spoofing mitigation algorithms using the carrierphase double differences were performed using Detector 2a (assuming known noise variance) and Detector 2b (assuming unknown noise variance). Initial evaluations showed that the theoretical thresholds (using different probabilities of false alarm) did not perform well. The cause was probably that the carrierphase double differences under H 0 were not perfectly constant during the observation window, as assumed in the hypothesis test. That was likely caused by receiver time synchronization errors between the different receiver runs. The problem of using the theoretical threshold could also be the result of using a linear model for the change over time of double differences and the Gaussian noise assumption, which are simplifications. The results in Wang et al. (2018) also indicated that a more accurate time synchronization is needed for spoofing detection using double differences of carrier phase compared to pseudorange measurements. A more thorough analysis is needed in future work to exactly quantify how the synchronization accuracy and approximation errors of the simplifications affect the theoretical decision threshold and, consequently, the mitigation performance. However, the distribution of the test statistics under H 0 and H 1 was separate enough to enable separation by setting the threshold empirically. Therefore, the threshold was instead set based on the simulation data to yield a false alarm rate of 1%. That is, the test statistics featured in Equations (11) and (13) were computed based on the available simulation data under H 0. The decision thresholds were then set, based on these computed test statistics, such that the desired false alarm probability was achieved with equality. A single threshold was determined and used for Detector 2a, while it was set individually for each observation length for Detector 2b, in analogy with (12) and (14), considering all scenarios. Detector 2b showed a more consistent performance than Detector 2a and was able to authenticate the signals faster. Furthermore, the performance of Detector 2a decreased for observation windows longer than four minutes in most scenarios. Therefore, results for Detector 2a are not shown in Figure 5, in which the average number of correctly authenticated signals is shown for different observation windows using Detector 2b. The number of incorrectly authenticated signals was zero in all cases for the results in Figure 5 using Detector 2b. Similarly to the pseudorange evaluations, longer observation windows and receiver distances provide better performance in most cases. The performance decreases for some of the longer observation windows, which could be caused by the small time variations of double differences under H 0, which are more noticeable for longer observation times. The model of the double difference as affine in time under H 1 is less accurate over long time windows, which also affects the performance negatively.
18 4.4 Spoofing Mitigation with Two and More Receivers The performance can be improved by using more than two receivers. The mitigation approach was evaluated next using more than two receivers, using Detector 1b (i.e., pseudorange measurements and assuming the noise variance is unknown). The theoretical thresholds were used with P FA = 1%. The combinations of receivers that had a minimum separation of 5 and 50meter distances according to Table 4 were evaluated (see Figure 6). The number of incorrectly authenticated signals in the 5meter scenario was zero for observation times of 30 seconds and longer, but occurred sporadically for the shorter observation times. No signals were incorrectly authenticated in the 50meter scenario. As seen in Figure 6, increasing the number of receivers significantly improves the performance for closely spaced receivers. For widely spaced receivers, the addition of extra receivers has the potential to improve the number of authenticated signals for short observation windows. TABLE 4 Combination of multiple receivers; the reference receiver is underlined. Distance equates to distance to reference receiver. Distance Receivers Combinations 5 1,6,7 {1, 6}, {6, 7}, {1, 6, 7} 50 1,3,4,10 {1, 4}, {1, 10}, {1, 4, 10},... {1, 3, 4, 10} FIGURE 6 Average number of correctly authenticated signals as a function of observation time; the scenario with receivers 1, 6, and 7 (5meter distances) used Receiver 6 as reference. The scenario with receivers 1, 3, 4, and 10 (50meter distances) used Receiver 1 as reference. In total, seven authentic and seven spoofing signals were tracked. 5 LIVESKY TESTS In addition to the simulated spoofing attacks, evaluations have also been done with livesky signals and spoofing attacks performed as real overtheair meaconing (replay) attacks. The tests were performed at Vidsel Test Range in Sweden during the fall of 2019.
19 5.1 LiveSky Meaconing Scenarios The spoofing tests were performed as replayattacks where the spoofed position was about 900 m from the authentic positions. The spoofing system introduced delays to the spoofing signals equivalent of approximately one kilometer between the spoofer and the receivers under attack. Since the spoofing tests were performed as replayattacks, the spoofing signals were those signals received by the spoofing system s receiver antenna. Since the spoofing system was close to the victim receivers, the spoofing signals matched more or less the same authentic satellite signals as seen by the victim receivers. Complex baseband samples were recorded using USRP B210 with a sample rate of 4 MHz at the L1 frequency simultaneously for different static antenna positions. Two receiver pairs were considered in the evaluations. The first pair consisted of receivers denoted Rx A and Rx B, separated by approximately 50 m. The second receiver pair evaluated consisted of receivers Rx A and Rx C, separated by approximately 15 m. The receiver positions, as well as the position of the receiver and transmitting antennas of the spoofing system, are shown in Figure 7. Evaluations were performed using pseudorange measurements, and assuming the noise variance to be unknown (i.e., Detector 1b). The spoofing power was ramped (2 db every 30 seconds) during the test. The rather short time duration on each power level resulted in a time window in which two correlation peaks (authentic and spoofed) were visible simultaneously for quite a short time. In total, 40 power levels were used on both the up and down intervals, and the max power was maintained for five minutes. The mitigation worked only on the intervals of the meaconing tests in which the correlation peaks from both the authentic and spoofing signals could be acquired simultaneously (i.e., when the spoofing power was not too high or too FIGURE 7 Receiver positions and the position of transmitting and receiver antennas of spoofing system in livesky tests
20 low). Therefore, evaluations were performed on subintervals of the meaconing tests. In that respect, the algorithm is more suited for spoofing in which the spoofing power is not much higher than the authentic signals. In these cases, longer authentication windows might be possible, and hence it is more likely that two correlation peaks would be visible simultaneously in two (or more) receivers for multiple satellites. 5.2 Estimated JammertoNoise Power Ratio The jammertonoise power ratio, denoted J/N, was estimated in the tests to gain an idea of how the power ramp was experienced at the receivers. It should be noted that the more general and commonly used terms jammertonoise and J/N are used to denote the power ratio, although the attack consists of spoofing only. The J/N was estimated based on the baseband I/Q samples recorded by the USRPs. The received power, denoted P r, was estimated and averaged over the 30s ramp steps. The noise power, denoted by P n, was estimated as the average of P r in an interval before the meaconing started. J/N in db was estimated as 10log 10 ((P r P n )/P n ). See Figure 8 for an example of the estimated J/N. Note the nonlinearities in the beginning and end of the ramp and that the USRP became saturated for high spoofing powers. The steps in the estimated J/N were close to the expected 2 db in the middle of the ramp up and down parts. The shown theoretical ramp was adjusted to match these steps that were close to 2 db. FIGURE 8 Estimated J/N using receiver Rx B over 30s ramp steps showing a theoretical ramp adjusted with the help of the USRPestimated J/N
21 5.3 Results with Unmodified Receivers in the Meaconing Tests In a scenario in which the spoofing power is ramped up and then down, a (normal) receiver (e.g., unmodified GNSSSDR) initially locks onto the authentic satellite signals when there are no spoofing signals present, and provides PVT solutions consistent with the true state of the receiver. When the power transmitted from the spoofing system is increased and becomes high enough, the receiver eventually locks onto the spoofing signals and start computing an incorrect (spoofed) position. Next, the power transmitted from the spoofing system is ramped down and the receiver eventually loses lock of the spoofing signals (not necessarily at the same time). The receiver can then lock onto the authentic signals and true PVT solutions are eventually computed. Results for the unmodified version of GNSSSDR are shown in Figure 9. The figure shows the estimated J/N and the horizontal position error. The computed positions did not switch back to the true position in this particular test due to the tracking loops still being locked on to the spoofing signals that were still strong enough to be tracked, but the receiver was just about to lose the spoofing position as seen by the increasing variations of the position error at the end of the test. There are (small) intervals in which both authentic and spoofing signals have approximately the same power during the rampup and rampdown phases. It is possible to acquire spoofing signals as well as the authentic signals in these intervals and use them to evaluate the algorithm. Figure 10 shows an example of the (acquisition) correlation function of a onetime instance during such an interval for receiver Rx A. The figure shows two visible correlation peaks corresponding to the authentic and spoofing signal, respectively. FIGURE 9 Horizontal position error based on position computations from GNSSSDR; ramp in J/N (db) based on USRP data with averaging over the 30s ramp steps
22 FIGURE 10 Correlation function at time instance 09:28:25, receiver Rx A and PRN Evaluation of Spoofing Mitigation on the RampDown Part of the Meaconing Tests Consider the end of a test in which the spoofing power is ramped down. Only spoofing signals are possible to acquire initially, but the authentic signals eventually become available when the spoofing power is decreased. However, the receiver might still track the spoofing signals and provide incorrect PVT solutions. The modified version of GNSSSDR, with the proposed spoofing mitigation algorithms, can be run to acquire and track weaker authentic signals. When the modified GNSSSDR has acquired two signals per satellite for multiple satellites during the rampdown process, the mitigation algorithms identify the spoofing signals and discard them, leaving authentic signals for the computation of position estimates. The most notable improvement of using the mitigation algorithm is achieved on the rampdown portion of these tests. The unmodified version of GNSSSDR kept tracking authentic signals on the rampup part until the authentic signals became essentially unusable. Therefore, there was no clear improvement in the ability to continue computing true position estimates on the rampup part using the mitigation process compared to using the unmodified version of GNSSSDR. The first receiver pair with receivers Rx A and Rx B were used to evaluate the end of the ramp test. The receivers were separated by approximately 50 m. Receiver Rx B was placed approximately 70 m from the spoofing transmit antenna and Rx A approximately m from the spoofing transmit antenna. The algorithm was run on a 15second observation interval based on authentication of five satellites that were tracked by both receivers. Horizontal error after spoofing mitigation using RTKLIB as well as using the unmodified GNSSSDR is shown in Figures 11 and 12. Note that less frequent position solutions are produced in the unmodified GNSSSDR which uses the spoofing signals when their power decreases. The J/N is also shown, estimated using the
Post Processing Service
Post Processing Service The delay of propagation of the signal due to the ionosphere is the main source of generation of positioning errors. This problem can be bypassed using a dualfrequency receivers
More informationGNSS integrity monitoring for the detection and mitigation of interference
GNSS integrity monitoring for the detection and mitigation of interference Dr. Shaojun Feng Centre for Transport Studies Outline GNSS vulnerability GNSS integrity monitoring Cases study GAARDIAN ERAIM
More informationTI GPS PPS Timing Application Note
Application Note Version 0.6 January 2012 1 Contents Table of Contents 1 INTRODUCTION... 3 2 1PPS CHARACTERISTICS... 3 3 TEST SETUP... 4 4 PPS TEST RESULTS... 6 Figures Figure 1  Simplified GPS Receiver
More informationCHARACTERISTICS OF DEEP GPS SIGNAL FADING DUE TO IONOSPHERIC SCINTILLATION FOR AVIATION RECEIVER DESIGN
CHARACTERISTICS OF DEEP GPS SIGNAL FADING DUE TO IONOSPHERIC SCINTILLATION FOR AVIATION RECEIVER DESIGN Jiwon Seo, Todd Walter, TsungYu Chiou, and Per Enge Stanford University ABSTRACT Aircraft navigation
More informationSURVEYING WITH GPS. GPS has become a standard surveying technique in most surveying practices
SURVEYING WITH GPS Key Words: Static, Faststatic, Kinematic, Pseudo Kinematic, Realtime kinematic, Receiver Initialization, On The Fly (OTF), Baselines, Redundant baselines, Base Receiver, Rover GPS
More informationOverview of Violations of the Basic Assumptions in the Classical Normal Linear Regression Model
Overview of Violations of the Basic Assumptions in the Classical Normal Linear Regression Model 1 September 004 A. Introduction and assumptions The classical normal linear regression model can be written
More informationA GPS Digital Phased Array Antenna and Receiver
A GPS Digital Phased Array Antenna and Receiver Dr. Alison Brown, Randy Silva; NAVSYS Corporation ABSTRACT NAVSYS High Gain Advanced GPS Receiver (HAGR) uses a digital beamsteering antenna array to enable
More informationPHASE ESTIMATION ALGORITHM FOR FREQUENCY HOPPED BINARY PSK AND DPSK WAVEFORMS WITH SMALL NUMBER OF REFERENCE SYMBOLS
PHASE ESTIMATION ALGORITHM FOR FREQUENCY HOPPED BINARY PSK AND DPSK WAVEFORMS WITH SMALL NUM OF REFERENCE SYMBOLS Benjamin R. Wiederholt The MITRE Corporation Bedford, MA and Mario A. Blanco The MITRE
More informationSecure Location Verification
Secure Location Verification A Security Analysis of GPS Signal Authentication Georg T. Becker 12, Sherman C. Lo 3, David S. De Lorenzo 3, Per K. Enge 3, Christof Paar 1 1 Horst Görtz Institute for IT Security,
More informationCDMA TECHNOLOGY. Brief Working of CDMA
CDMA TECHNOLOGY History of CDMA The Cellular Challenge The world's first cellular networks were introduced in the early 1980s, using analog radio transmission technologies such as AMPS (Advanced Mobile
More informationMath 215 Project (25 pts) : Using Linear Algebra to solve GPS problem
Due Thursday March 1, 2012 NAME(S): Math 215 Project (25 pts) : Using Linear Algebra to solve GPS problem 0.1 Introduction The age old question, Where in the world am I? can easily be solved nowadays by
More informationHD Radio FM Transmission System Specifications Rev. F August 24, 2011
HD Radio FM Transmission System Specifications Rev. F August 24, 2011 SY_SSS_1026s TRADEMARKS HD Radio and the HD, HD Radio, and Arc logos are proprietary trademarks of ibiquity Digital Corporation. ibiquity,
More informationGPS Receiver Test. Conducted by the Department of Mathematical Geodesy and Positioning Delft University of Technology
GPS Receiver Test Conducted by the Department of Mathematical Geodesy and Positioning Delft University of Technology A. AmiriSimkooei R. Kremers C. Tiberius May 24 Preface For the purpose of a receiver
More informationDepartment of Electrical and Computer Engineering BenGurion University of the Negev. LAB 1  Introduction to USRP
Department of Electrical and Computer Engineering BenGurion University of the Negev LAB 1  Introduction to USRP  11 Introduction In this lab you will use software reconfigurable RF hardware from National
More informationThe Effective Number of Bits (ENOB) of my R&S Digital Oscilloscope Technical Paper
The Effective Number of Bits (ENOB) of my R&S Digital Oscilloscope Technical Paper Products: R&S RTO1012 R&S RTO1014 R&S RTO1022 R&S RTO1024 This technical paper provides an introduction to the signal
More informationDigital Modulation. David Tipper. Department of Information Science and Telecommunications University of Pittsburgh. Typical Communication System
Digital Modulation David Tipper Associate Professor Department of Information Science and Telecommunications University of Pittsburgh http://www.tele.pitt.edu/tipper.html Typical Communication System Source
More informationPART 5D TECHNICAL AND OPERATING CHARACTERISTICS OF MOBILESATELLITE SERVICES RECOMMENDATION ITUR M.1188
Rec. ITUR M.1188 1 PART 5D TECHNICAL AND OPERATING CHARACTERISTICS OF MOBILESATELLITE SERVICES Rec. ITUR M.1188 RECOMMENDATION ITUR M.1188 IMPACT OF PROPAGATION ON THE DESIGN OF NONGSO MOBILESATELLITE
More informationSPECIAL PERTURBATIONS UNCORRELATED TRACK PROCESSING
AAS 07228 SPECIAL PERTURBATIONS UNCORRELATED TRACK PROCESSING INTRODUCTION James G. Miller * Two historical uncorrelated track (UCT) processing approaches have been employed using general perturbations
More informationFREE FALL. Introduction. Reference Young and Freedman, University Physics, 12 th Edition: Chapter 2, section 2.5
Physics 161 FREE FALL Introduction This experiment is designed to study the motion of an object that is accelerated by the force of gravity. It also serves as an introduction to the data analysis capabilities
More informationFundamental to determining
GNSS Solutions: CarriertoNoise Algorithms GNSS Solutions is a regular column featuring questions and answers about technical aspects of GNSS. Readers are invited to send their questions to the columnist,
More informationNonData Aided Carrier Offset Compensation for SDR Implementation
NonData Aided Carrier Offset Compensation for SDR Implementation Anders Riis Jensen 1, Niels Terp Kjeldgaard Jørgensen 1 Kim Laugesen 1, Yannick Le Moullec 1,2 1 Department of Electronic Systems, 2 Center
More informationImplementing an InService, Non Intrusive Measurement Device in Telecommunication Networks Using the TMS320C31
Disclaimer: This document was part of the First European DSP Education and Research Conference. It may have been written by someone whose native language is not English. TI assumes no liability for the
More informationSample Size and Power in Clinical Trials
Sample Size and Power in Clinical Trials Version 1.0 May 011 1. Power of a Test. Factors affecting Power 3. Required Sample Size RELATED ISSUES 1. Effect Size. Test Statistics 3. Variation 4. Significance
More informationLeastSquares Intersection of Lines
LeastSquares Intersection of Lines Johannes Traa  UIUC 2013 This writeup derives the leastsquares solution for the intersection of lines. In the general case, a set of lines will not intersect at a
More informationEUTERPE  EUROPEAN TEST CENTRE FOR RECEIVER PERFORMANCE EVALUATION
ABSTRACT EUTERPE  EUROPEAN TEST CENTRE FOR RECEIVER PERFORMANCE EVALUATION David JiménezBaños (1), Michel Tossaint (1), JeanLuc Gerner (1), Rafael LucasRodríguez (2) (1) Radio Navigation Systems and
More informationMULTIPLE REGRESSION AND ISSUES IN REGRESSION ANALYSIS
MULTIPLE REGRESSION AND ISSUES IN REGRESSION ANALYSIS MSR = Mean Regression Sum of Squares MSE = Mean Squared Error RSS = Regression Sum of Squares SSE = Sum of Squared Errors/Residuals α = Level of Significance
More informationAntennas & Propagation. CS 6710 Spring 2010 Rajmohan Rajaraman
Antennas & Propagation CS 6710 Spring 2010 Rajmohan Rajaraman Introduction An antenna is an electrical conductor or system of conductors o Transmission  radiates electromagnetic energy into space o Reception
More informationEnhancing the SNR of the Fiber Optic Rotation Sensor using the LMS Algorithm
1 Enhancing the SNR of the Fiber Optic Rotation Sensor using the LMS Algorithm Hani Mehrpouyan, Student Member, IEEE, Department of Electrical and Computer Engineering Queen s University, Kingston, Ontario,
More informationis the power reference: Specifically, power in db is represented by the following equation, where P0 P db = 10 log 10
RF Basics  Part 1 This is the first article in the multipart series on RF Basics. We start the series by reviewing some basic RF concepts: Decibels (db), Antenna Gain, Freespace RF Propagation, RF Attenuation,
More informationAgilent AN 1316 Optimizing Spectrum Analyzer Amplitude Accuracy
Agilent AN 1316 Optimizing Spectrum Analyzer Amplitude Accuracy Application Note RF & Microwave Spectrum Analyzers Table of Contents 3 3 4 4 5 7 8 8 13 13 14 16 16 Introduction Absolute versus relative
More informationDVBT. C/N in a static Rayleigh channel. C/N values for portable single and diversity reception. Measurement method.
C/N values for portable single and diversity reception Raul Schramm IRT It has been shown that the minimum C/N values for goodquality portable reception in a static Rayleigh channel as given in the ETSI
More informationSecure Navigation and Authentication. Sherman Lo November 2008
Secure Navigation and Authentication Sherman Lo November 2008 1 Outline Motivating Authentication Proposed techniques for authentication Source authentication Cross checking My research 2 GNSS: Position,
More informationLeast Squares Estimation
Least Squares Estimation SARA A VAN DE GEER Volume 2, pp 1041 1045 in Encyclopedia of Statistics in Behavioral Science ISBN13: 9780470860809 ISBN10: 0470860804 Editors Brian S Everitt & David
More informationCalculation of Risk Factor Using the Excel spreadsheet Calculation of Risk Factor.xls
Calculation of Risk Factor Using the Excel spreadsheet Calculation of Risk Factor.xls Events, Impact and Software Validation Table of Contents Many software products in complex computer systems like LIS
More informationCDMA Technology : Pr. S. Flament www.greyc.fr/user/99. Pr. Dr. W. sk www.htwgkonstanz.de. On line Course on CDMA Technology
CDMA Technology : Pr. Dr. W. sk www.htwgkonstanz.de Pr. S. Flament www.greyc.fr/user/99 On line Course on CDMA Technology CDMA Technology : CDMA / DS : Principle of operation Generation of PN Spreading
More informationPropagation Channel Emulator ECP_V3
Navigation simulators Propagation Channel Emulator ECP_V3 1 Product Description The ECP (Propagation Channel Emulator V3) synthesizes the principal phenomena of propagation occurring on RF signal links
More informationLecture 8: Signal Detection and Noise Assumption
ECE 83 Fall Statistical Signal Processing instructor: R. Nowak, scribe: Feng Ju Lecture 8: Signal Detection and Noise Assumption Signal Detection : X = W H : X = S + W where W N(, σ I n n and S = [s, s,...,
More informationImage Compression through DCT and Huffman Coding Technique
International Journal of Current Engineering and Technology EISSN 2277 4106, PISSN 2347 5161 2015 INPRESSCO, All Rights Reserved Available at http://inpressco.com/category/ijcet Research Article Rahul
More informationwith functions, expressions and equations which follow in units 3 and 4.
Grade 8 Overview View unit yearlong overview here The unit design was created in line with the areas of focus for grade 8 Mathematics as identified by the Common Core State Standards and the PARCC Model
More informationApplication Note Receiving HF Signals with a USRP Device Ettus Research
Application Note Receiving HF Signals with a USRP Device Ettus Research Introduction The electromagnetic (EM) spectrum between 3 and 30 MHz is commonly referred to as the HF band. Due to the propagation
More informationLeica SmartNet UK & Ireland Network RTK User Guide
Leica SmartNet UK & Ireland Network RTK User Guide Contents Background.. Page 3 Single Base RTK.... Page 3 Advantages & Disadvantages of Single Base RTK Page 4 Network RTK... Page 4 Advantages & Disadvantages
More informationAgenda. Agilent GPS Receiver Test Solutions. GPS technology concepts. Basic tests required for GPS receiver verification Test solutions
Agenda GPS technology concepts GPS and GNSS overview Assisted GPS (AGPS) Basic tests required for GPS receiver verification Test solutions Signal creation for GPS receiver test AGPS test systems Agilent
More informationLinear Threshold Units
Linear Threshold Units w x hx (... w n x n w We assume that each feature x j and each weight w j is a real number (we will relax this later) We will study three different algorithms for learning linear
More informationUnderstanding and Applying Kalman Filtering
Understanding and Applying Kalman Filtering Lindsay Kleeman Department of Electrical and Computer Systems Engineering Monash University, Clayton 1 Introduction Objectives: 1. Provide a basic understanding
More informationLecture Notes Module 1
Lecture Notes Module 1 Study Populations A study population is a clearly defined collection of people, animals, plants, or objects. In psychological research, a study population usually consists of a specific
More information1 Solving LPs: The Simplex Algorithm of George Dantzig
Solving LPs: The Simplex Algorithm of George Dantzig. Simplex Pivoting: Dictionary Format We illustrate a general solution procedure, called the simplex algorithm, by implementing it on a very simple example.
More informationAn introduction to ValueatRisk Learning Curve September 2003
An introduction to ValueatRisk Learning Curve September 2003 ValueatRisk The introduction of ValueatRisk (VaR) as an accepted methodology for quantifying market risk is part of the evolution of risk
More informationLean Six Sigma Analyze Phase Introduction. TECH 50800 QUALITY and PRODUCTIVITY in INDUSTRY and TECHNOLOGY
TECH 50800 QUALITY and PRODUCTIVITY in INDUSTRY and TECHNOLOGY Before we begin: Turn on the sound on your computer. There is audio to accompany this presentation. Audio will accompany most of the online
More informationLezione 6 Communications Blockset
Corso di Tecniche CAD per le Telecomunicazioni A.A. 20072008 Lezione 6 Communications Blockset Ing. Marco GALEAZZI 1 What Is Communications Blockset? Communications Blockset extends Simulink with a comprehensive
More informationStep Response of RC Circuits
Step Response of RC Circuits 1. OBJECTIVES...2 2. REFERENCE...2 3. CIRCUITS...2 4. COMPONENTS AND SPECIFICATIONS...3 QUANTITY...3 DESCRIPTION...3 COMMENTS...3 5. DISCUSSION...3 5.1 SOURCE RESISTANCE...3
More informationOn Correlating Performance Metrics
On Correlating Performance Metrics Yiping Ding and Chris Thornley BMC Software, Inc. Kenneth Newman BMC Software, Inc. University of Massachusetts, Boston Performance metrics and their measurements are
More informationDIGITALTOANALOGUE AND ANALOGUETODIGITAL CONVERSION
DIGITALTOANALOGUE AND ANALOGUETODIGITAL CONVERSION Introduction The outputs from sensors and communications receivers are analogue signals that have continuously varying amplitudes. In many systems
More informationModelling, Extraction and Description of Intrinsic Cues of High Resolution Satellite Images: Independent Component Analysis based approaches
Modelling, Extraction and Description of Intrinsic Cues of High Resolution Satellite Images: Independent Component Analysis based approaches PhD Thesis by Payam Birjandi Director: Prof. Mihai Datcu Problematic
More informationImplementation of Digital Signal Processing: Some Background on GFSK Modulation
Implementation of Digital Signal Processing: Some Background on GFSK Modulation Sabih H. Gerez University of Twente, Department of Electrical Engineering s.h.gerez@utwente.nl Version 4 (February 7, 2013)
More informationAutomatic Detection of Emergency Vehicles for Hearing Impaired Drivers
Automatic Detection of Emergency Vehicles for Hearing Impaired Drivers Sungwon ark and Jose Trevino Texas A&M UniversityKingsville, EE/CS Department, MSC 92, Kingsville, TX 78363 TEL (36) 5932638, FAX
More informationImplementation of Data Mining Techniques for Weather Report Guidance for Ships Using Global Positioning System
International Journal Of Computational Engineering Research (ijceronline.com) Vol. 3 Issue. 3 Implementation of Data Mining Techniques for Weather Report Guidance for Ships Using Global Positioning System
More informationSpectrum analyzer with USRP, GNU Radio and MATLAB
Spectrum analyzer with USRP, GNU Radio and MATLAB António José Costa, João Lima, Lúcia Antunes, Nuno Borges de Carvalho {antoniocosta, jflima, a30423, nbcarvalho}@ua.pt January 23, 2009 Abstract In this
More informationRECOMMENDATION ITUR F.1113. (Question ITUR 157/9) b) that systems using this mode of propagation are already in service for burst data transmission,
Rec. ITUR F.1113 1 RECOMMENDATION ITUR F.1113 RADIO SYSTEMS EMPLOYING METEORBURST PROPAGATION (Question ITUR 157/9) (1994) Rec. ITUR F.1113 The ITU Radiocommunication Assembly, considering a) that
More informationAssociation Between Variables
Contents 11 Association Between Variables 767 11.1 Introduction............................ 767 11.1.1 Measure of Association................. 768 11.1.2 Chapter Summary.................... 769 11.2 Chi
More informationCHAPTER 13 SIMPLE LINEAR REGRESSION. Opening Example. Simple Regression. Linear Regression
Opening Example CHAPTER 13 SIMPLE LINEAR REGREION SIMPLE LINEAR REGREION! Simple Regression! Linear Regression Simple Regression Definition A regression model is a mathematical equation that descries the
More informationA comparison of radio directionfinding technologies. Paul Denisowski, Applications Engineer Rohde & Schwarz
A comparison of radio directionfinding technologies Paul Denisowski, Applications Engineer Rohde & Schwarz Topics General introduction to radiolocation Manual DF techniques Doppler DF Time difference
More information1 Multichannel frequency division multiplex frequency modulation (FDMFM) emissions
Rec. ITUR SM.8531 1 RECOMMENDATION ITUR SM.8531 NECESSARY BANDWIDTH (Question ITUR 77/1) Rec. ITUR SM.8531 (19921997) The ITU Radiocommunication Assembly, considering a) that the concept of necessary
More informationSYSTEM GLOBAL NAVIGATION SATELLITE SYSTEM LANDING TECHNOLOGY/PRODUCT DEVELOPMENT
GLOBAL NAVIGATION SATELLITE SYSTEM LANDING SYSTEM The aviation industry is developing a new positioning and landing system based on the Global Navigation Satellite System (GNSS). The GNSS landing system
More informationHow to choose an Application specific Signal Detection Threshold for TDA523x based ASK Mode Applications
How to choose an Application specific Signal Detection Threshold for TDA523x based ASK Mode Applications The TDA523x has an integrated Signal Detector, a mechanism to distinguish in between useful data
More informationAlgebra 1 2008. Academic Content Standards Grade Eight and Grade Nine Ohio. Grade Eight. Number, Number Sense and Operations Standard
Academic Content Standards Grade Eight and Grade Nine Ohio Algebra 1 2008 Grade Eight STANDARDS Number, Number Sense and Operations Standard Number and Number Systems 1. Use scientific notation to express
More informationThe front end of the receiver performs the frequency translation, channel selection and amplification of the signal.
Many receivers must be capable of handling a very wide range of signal powers at the input while still producing the correct output. This must be done in the presence of noise and interference which occasionally
More informationEE4367 Telecom. Switching & Transmission. Prof. Murat Torlak
Path Loss Radio Wave Propagation The wireless radio channel puts fundamental limitations to the performance of wireless communications systems Radio channels are extremely random, and are not easily analyzed
More informationRESULTS OF TESTS WITH DOMESTIC RECEIVER IC S FOR DVBT. C.R. Nokes BBC R&D, UK ABSTRACT
RESULTS OF TESTS WITH DOMESTIC RECEIVER IC S FOR DVBT C.R. Nokes BBC R&D, UK ABSTRACT Digital terrestrial television services using the DVBT standard will be launched later this year in the UK, followed
More informationRapid Prototyping of a Frequency Hopping Ad Hoc Network System
Rapid Prototyping of a Frequency Hopping Ad Hoc Network System Martin Braun, Nico Otterbach, Jens Elsner, and Friedrich K. Jondral Communications Engineering Lab, Karlsruhe Institute of Technology (KIT),
More informationAmplification of the Radiation from Two Collocated Cellular System Antennas by the Ground Wave of an AM Broadcast Station
Amplification of the Radiation from Two Collocated Cellular System Antennas by the Ground Wave of an AM Broadcast Station Dr. Bill P. Curry EMSciTek Consulting Co., W101 McCarron Road Glen Ellyn, IL 60137,
More informationRemote Calibration of a GPS Timing Receiver to UTC(NIST) via the Internet*
Remote Calibration of a GPS Timing Receiver to UTC(NIST) via the Internet* Michael A. Lombardi and Andrew N. Novick National Institute of Standards and Technology Boulder, Colorado lombardi@boulder.nist.gov
More informationUnderstanding Range for RF Devices
Understanding Range for RF Devices October 2012 White Paper Understanding how environmental factors can affect range is one of the key aspects to deploying a radio frequency (RF) solution. This paper will
More informationThis unit will lay the groundwork for later units where the students will extend this knowledge to quadratic and exponential functions.
Algebra I Overview View unit yearlong overview here Many of the concepts presented in Algebra I are progressions of concepts that were introduced in grades 6 through 8. The content presented in this course
More informationOperational Amplifier  IC 741
Operational Amplifier  IC 741 Tabish December 2005 Aim: To study the working of an 741 operational amplifier by conducting the following experiments: (a) Input bias current measurement (b) Input offset
More informationChapter 1. Vector autoregressions. 1.1 VARs and the identi cation problem
Chapter Vector autoregressions We begin by taking a look at the data of macroeconomics. A way to summarize the dynamics of macroeconomic data is to make use of vector autoregressions. VAR models have become
More informationAN1200.04. Application Note: FCC Regulations for ISM Band Devices: 902928 MHz. FCC Regulations for ISM Band Devices: 902928 MHz
AN1200.04 Application Note: FCC Regulations for ISM Band Devices: Copyright Semtech 2006 1 of 15 www.semtech.com 1 Table of Contents 1 Table of Contents...2 1.1 Index of Figures...2 1.2 Index of Tables...2
More informationDVBT. The echo performance of. receivers. Theory of echo tolerance. Ranulph Poole BBC Research and Development
The echo performance of DVBT Ranulph Poole BBC Research and Development receivers This article introduces a model to describe the way in which a single echo gives rise to an equivalent noise floor (ENF)
More informationRF Measurements Using a Modular Digitizer
RF Measurements Using a Modular Digitizer Modern modular digitizers, like the Spectrum M4i series PCIe digitizers, offer greater bandwidth and higher resolution at any given bandwidth than ever before.
More informationAntenna Properties and their impact on Wireless System Performance. Dr. Steven R. Best. Cushcraft Corporation 48 Perimeter Road Manchester, NH 03013
Antenna Properties and their impact on Wireless System Performance Dr. Steven R. Best Cushcraft Corporation 48 Perimeter Road Manchester, NH 03013 Phone (603) 6277877 FAX: (603) 6271764 Email: sbest@cushcraft.com
More informationSIGNAL GENERATORS and OSCILLOSCOPE CALIBRATION
1 SIGNAL GENERATORS and OSCILLOSCOPE CALIBRATION By Lannes S. Purnell FLUKE CORPORATION 2 This paper shows how standard signal generators can be used as leveled sine wave sources for calibrating oscilloscopes.
More informationSection 1.1 Linear Equations: Slope and Equations of Lines
Section. Linear Equations: Slope and Equations of Lines Slope The measure of the steepness of a line is called the slope of the line. It is the amount of change in y, the rise, divided by the amount of
More informationTime and Frequency Domain Equalization
Time and Frequency Domain Equalization Presented By: Khaled Shawky Hassan Under Supervision of: Prof. Werner Henkel Introduction to Equalization Nonideal analogmedia such as telephone cables and radio
More informationRevision of Lecture Eighteen
Revision of Lecture Eighteen Previous lecture has discussed equalisation using Viterbi algorithm: Note similarity with channel decoding using maximum likelihood sequence estimation principle It also discusses
More informationPresentation Outline. The NavSAS group; Examples of SoftwareRadio Technology in GNSS;
Telemobility 2008 Progetto Galileo ed altri GNSS Development of GPSGalileo Galileo Software Radio Receivers Marco Pini  NavSAS group Presentation Outline The NavSAS group; Basic on SoftwareRadio Technology;
More informationRegression III: Advanced Methods
Lecture 16: Generalized Additive Models Regression III: Advanced Methods Bill Jacoby Michigan State University http://polisci.msu.edu/jacoby/icpsr/regress3 Goals of the Lecture Introduce Additive Models
More informationPROTECTION OF THE BROADCASTING SERVICE FROM BROADCASTING SATELLITE SERVICE TRANSMISSIONS IN THE BAND 620 790 MHz
Electronic Communications Committee (ECC) within the European Conference of Postal and Telecommunications Administrations (CEPT) PROTECTION OF THE BROADCASTING SERVICE FROM BROADCASTING SATELLITE SERVICE
More informationFace detection is a process of localizing and extracting the face region from the
Chapter 4 FACE NORMALIZATION 4.1 INTRODUCTION Face detection is a process of localizing and extracting the face region from the background. The detected face varies in rotation, brightness, size, etc.
More informationSolving Simultaneous Equations and Matrices
Solving Simultaneous Equations and Matrices The following represents a systematic investigation for the steps used to solve two simultaneous linear equations in two unknowns. The motivation for considering
More informationGlobal Positioning System
B. HofmannWellenhof, H. Lichtenegger, and J. Collins Global Positioning System Theory and Practice Third, revised edition SpringerVerlag Wien New York Contents Abbreviations Numerical constants xix xxiii
More information4 UNIT FOUR: Transportation and Assignment problems
4 UNIT FOUR: Transportation and Assignment problems 4.1 Objectives By the end of this unit you will be able to: formulate special linear programming problems using the transportation model. define a balanced
More informationMATRIX ALGEBRA AND SYSTEMS OF EQUATIONS
MATRIX ALGEBRA AND SYSTEMS OF EQUATIONS Systems of Equations and Matrices Representation of a linear system The general system of m equations in n unknowns can be written a x + a 2 x 2 + + a n x n b a
More informationAuxiliary Variables in Mixture Modeling: 3Step Approaches Using Mplus
Auxiliary Variables in Mixture Modeling: 3Step Approaches Using Mplus Tihomir Asparouhov and Bengt Muthén Mplus Web Notes: No. 15 Version 8, August 5, 2014 1 Abstract This paper discusses alternatives
More informationTesting Research and Statistical Hypotheses
Testing Research and Statistical Hypotheses Introduction In the last lab we analyzed metric artifact attributes such as thickness or width/thickness ratio. Those were continuous variables, which as you
More informationA SIMULATION STUDY ON SPACETIME EQUALIZATION FOR MOBILE BROADBAND COMMUNICATION IN AN INDUSTRIAL INDOOR ENVIRONMENT
A SIMULATION STUDY ON SPACETIME EQUALIZATION FOR MOBILE BROADBAND COMMUNICATION IN AN INDUSTRIAL INDOOR ENVIRONMENT U. Trautwein, G. Sommerkorn, R. S. Thomä FG EMT, Ilmenau University of Technology P.O.B.
More informationModule 3: Correlation and Covariance
Using Statistical Data to Make Decisions Module 3: Correlation and Covariance Tom Ilvento Dr. Mugdim Pašiƒ University of Delaware Sarajevo Graduate School of Business O ften our interest in data analysis
More informationGSM Frequency Planning with Band Segregation for the Broadcast Channel Carriers
GSM Frequency Planning with Band Segregation for the Broadcast Channel Carriers F. Galliano (1), N.P. Magnani (1), G. Minerva (1), A. Rolando (2), P. Zanini (3) (1) CSELT  Via G. Reiss Romoli, 274  Torino
More informationSession 7 Bivariate Data and Analysis
Session 7 Bivariate Data and Analysis Key Terms for This Session Previously Introduced mean standard deviation New in This Session association bivariate analysis contingency table covariation least squares
More informationMODULATION Systems (part 1)
Technologies and Services on Digital Broadcasting (8) MODULATION Systems (part ) "Technologies and Services of Digital Broadcasting" (in Japanese, ISBN4339622) is published by CORONA publishing co.,
More informationManual Analysis Software AFD 1201
AFD 1200  AcoustiTube Manual Analysis Software AFD 1201 Measurement of Transmission loss acc. to Song and Bolton 1 Table of Contents Introduction  Analysis Software AFD 1201... 3 AFD 1200  AcoustiTube
More informationPredict the Popularity of YouTube Videos Using Early View Data
000 001 002 003 004 005 006 007 008 009 010 011 012 013 014 015 016 017 018 019 020 021 022 023 024 025 026 027 028 029 030 031 032 033 034 035 036 037 038 039 040 041 042 043 044 045 046 047 048 049 050
More information